Access Denied

[Mario_Chretien_]

Hi,

Am trying to backup a Exchange Server from BEv.10 and W2K3 SP1. Am getting access Denied when choosing the Mailbox in the selection list.

My users has Exchange Admin privilege, Local Admin a valid Exchange Mailbox.

Try all KB article but still no luck

Any help would be appreciated.

Mario

[Amruta_Purandar]

Hello,

- Do you get this error message only for a particular mailbox or for all mailboxes?
- Are you able to select the Information Store?
- Does it prompt for a logon account?
- Please specify the exact error message.

NOTE : If we do not receive your reply within two business days, this post would be marked assumed answered and would be moved to answered questions pool.

[Mario_Chretien_]

Allo Amruta

- Do you get this error message only for a particular mailbox or for all mailboxes... All mailbox

- Are you able to select the Information Store...Yes
- Does it prompt for a logon account...Yes
- Please specify the exact error message...Logon Accout "Special Account" failed to access "Server1" mailbox. Access Denied.

Thank you

[Liz_Unger]

I am having the same problem however I am not on win2k3 sp1. I can access the store - but selecting the mailboxes or the public folders requests a brand new account. I've created a new account and set everything up again but still no luck

[Deepali_Badave]

Hello,

1. For backing up individual mailboxes, in addition to Local Admin and Domain Admin rights, you need to assign the Exchange Administrator role to the user account at the Administrative group level.

Additionally, verify if the Backup Exec Service Account you are using has a unique mailbox in the Exchange Server. If not, then you will need to create the same with the same name as that of your Backup Exec Service Account.
For additional information, please refer to the following TechNote:
Title: Logon Account " " failed to access "\\SERVER\Microsoft Exchange Mailbox". Access Denied.
http://seer.support.veritas.com/docs/256313.htm

============================================
This usually happens if the account is hidden from the Global Address List. To resolve the issue follow the steps given below.
1. Open the Active Directory Users and Computers Microsoft Management Console (MMC) snap-in

. Click View | Advanced Features

3. Locate, and then right-click the Backup Exec service account

4. Click Properties

5. Click the Exchange Advanced tab
After the mailbox is unhidden from the Global Address List, the user will be able to browse the mailboxes.

NOTE : If we do not receive your reply within two business days, this post would be marked assumed answered and would be moved to answered questions pool.

[Mario_Chretien_]

Hi Deepali

I follow all the instruction still the same!!!

One thing am not certain is the support doc.
If I understand it, Am suppose to create a user that has the same name as the account that I created when I did the install of BE but with a blank password is that wright???

Thank youMessage was edited by:
Mario Chretien

[Joe_Weinle]

We are having the same issue. I was able to resolve it the first few times by removing the account from the Exchange System Manger and re-adding. This worked twice. This time, however, it did not work. We have also attempted to use an account with Enterprise Admin rights and Full rights in Exchange. This account also fails. Our next step is to remove and reinstall the remote agents on the Exchange server. Any help is greatly appreciated.

Joe

[Amruta_Purandar]

Hello,

Please verify the following:

- Ensure that the Backup Exec service account mailbox is not hidden. The mailbox must be seen in the GAL
- Ensure that this account has the Exchange Full Admin rights
- The Backup Exec service account's mailbox must be unique to the organization. No other mailbox can share the first 5 characters in common with this mailbox in the entire organization.
- The Backup Exec service account must have its own mailbox that has been tested with Outlook prior to configuring mailbox backups. If the mailbox has not had mail traffic, it can be flagged as "Inactive" by Exchange. This can be corrected by simply sending this account mail.
- Create an account in Backup Exec under Network | Logon Accounts that contains the Exchange mailbox name as the name and has no password. Use this account to attach to the Exchange mailboxes. It is this account that should not have a password.
- If there are multiple message stores on this server, make sure the Backup Exec mailbox is located in the last or most recently added message store.
- Stop and re-start the Backup Exec services after making any of the above changes.


NOTE : If we do not receive your reply within two business days, this post would be marked assumed answered and would be moved to answered questions pool.

[Joe_Weinle]

Thank you for your reply. Creating a new account resolved the issue.

[Mario_Chretien_]

Hi again

1.Does it matter in what GAL the account appear in, because we have multiple GAL in are Domain

2.The backup exec account that you are taking about that needs to be tested with Outlook is that the same account name that am suppose to create the blank password for?
If so the policy in the domain doesn't allow blank password!

Thank you

[Sharvari_Deshmu]

Hello,

As mentioned earlier the BE account in GAL should be unique.

You can create an account without the password being a blank password.

We suggest that you create a new account for backing up exchange.

Please see the technote below for more information on this:
http://support.veritas.com/docs/242606

Thanks,

NOTE : If we do not receive your reply within two business days, this post would be marked "assumed answered" and would be moved to "answered questions" pool.

[Joe_Weinle]

I had said that the new account fixed the issue, well, it really didn't. We ended scrapping the mailbox backup because we could not get it to work. At some point, we were told to rename Mapi32.dll on our Exchange server and reboot. This was a very bad suggestion because that is a key file for Exchange. The funny part was that Veritas would not help us unless we did this. Seemed silly to me but we did it and sure enough, Exchange failed to start. We named it back and removed Mailbox backups.

[Sharvari_Deshmu]

Hello Mario,

We request you to update us on this issue.


Additional Information :
For information on the recent VERITAS Backup Exec security vulnerabilities, including links to the downloads for the necessary hotfixes, please refer to the following document:
Patch summary for Security Advisories VX05-001, VX05-002, VX05-003, VX05-005, VX05-006, VX05-007

http://seer.support.veritas.com/docs/277429.htm


NOTE : If we do not receive your reply within two business days, this post would be marked "assumed answered" and would be moved to "answered questions" pool.


Thanks,

[Mario_Chretien_]

Hi

Still having the same issue with new username.

Anyone out there ever did a multiple GAL/OAL setup on Exchange 2003 and try to back it up with BE???

HELP!!!!

[Amruta_Purandar]

Hello,

Please try the following technote and verify the results.

Title:
How to enable support for "Restrict Anonymous" when using Backup Exec 8.6, 9.x, and 10.0 for Windows Servers
http://support.veritas.com/docs/238618


Additional Information :
For information on the recent VERITAS Backup Exec security vulnerabilities, including links to the downloads for the necessary hotfixes, please refer to the following document:
Patch summary for Security Advisories VX05-001, VX05-002, VX05-003, VX05-005, VX05-006, VX05-007

http://seer.support.veritas.com/docs/277429.htm

NOTE : If we do not receive your reply within two business days, this post would be marked assumed answered and would be moved to answered questions pool.

[Mario_Chretien]

Hello Amruta

The new KB article did the trick.

Am curious what does it do?

Thanks

[Asma_Tamboli]

Hi,

Thanks for the update.

Restrict Anonymous is a key that allows administrators to prevent anonymous log on by a user, also known as Null session connections, to list account names or enumerate share names. It can be also used to determine whether a user can issue an anonymous query with a tool like LDAP to a directory service like the Exchange Directory, Microsoft Active Directory which is part of the system state, or Novell NDS

Here is a microsoft article that could also help you.

http://support.microsoft.com/kb/q246261/

Note : If we do not receive your reply within two business days, this post would be marked ‘assumed answered’ and would be moved to ‘answered questions’ pool.

[Iruku_Makanga]

I have tried all the suggestions mentioned. What am I missing? Resource Credentials test passes "successful". But I still get the access denied error.

Additional Info: I am using 10.0 rev 5484. OS is Windows 2003 SBS. I was unable to load any hotfixes or change revisions.Message was edited by:
Iruku Makanga